Banking regulatory authorities in the United States have launched a fundamental overhaul of model risk supervision, replacing the longstanding SR 11-7 framework after 15 years with the new SR 26-2 standard. However, the core of the revision contains a notable omission: Generative and autonomous agentic AI systems have been explicitly carved out from the immediate scope. Regulators cite the rapid and dynamic pace of technological development as the primary reason for postponing specific coverage.
For financial institutions, this exclusion creates significant operational uncertainties. Banks are aggressively integrating third-party AI agents and vendor software into their core workflows. Because these new tools do not fall neatly under traditional model risk management criteria, institutions are operating in a regulatory gray zone. At the same time, full legal accountability for model-driven outputs and compliance breaches remains squarely with the banks themselves.
Across the Atlantic, European authorities are intensifying their oversight in parallel. The European Central Bank has instructed euro area banks to submit comprehensive action plans by October 31, 2026, detailing how they intend to mitigate cyber and operational outage risks heightened by frontier AI models. This mandate aligns with joint guidance from the EBA, ESMA, and EIOPA under the Digital Operational Resilience Act, which tightly monitors dependencies on critical ICT third-party vendors and cloud hyperscalers.
Meanwhile, pressure is mounting in Washington for unified federal standards. In a formal submission to the House Committee on Financial Services, the American Fintech Council called for a risk-based and harmonized national framework for artificial intelligence in financial services. The association warned that a fragmented patchwork of state-level rules would disproportionately burden regional lenders and fintech startups.
The AFC argued that divergent state regulations could stifle innovation and tilt the competitive landscape heavily toward Wall Street giants with deep compliance resources. Smaller institutions risk being sidelined from productivity gains if regulatory clarity is delayed. Consequently, regulatory bodies face growing pressure to formulate dedicated rules for agentic systems before vendor adoption expands further.